CVE-2019-6780

Wise Chat <= 2.6.3 - Reverse Tabnabbing

mediumImproper Input Validation
6.1
CVSS Score
6.1
CVSS Score
medium
Severity
2.7
Patched in
1824d
Time to patch

Description

The Wise Chat plugin for WordPress is vulnerable to Reverse Tabnabbing in versions up to, and including, 2.6.3. This is due to mishandling of external links due to omitting noopener and noreferrer. This makes it possible for a chat-using attacker to provide a link that opens a new tab while silently redirecting the original - this can be used to redirect them to a phishing site on the original tab.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<2.7
PublishedJanuary 25, 2019
Last updatedJanuary 22, 2024
Affected pluginwise-chat

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.